@rynx-ai/runtime 0.1.0 → 0.1.10-beta.2

package/dist/claude/native-hook-main.js

@@ -1,20 +1,10 @@
 #!/usr/bin/env node
-/**
- * Standalone Claude Code hook entrypoint (built to `dist/claude/native-hook-main.js`,
- * invoked as `node native-hook-main.js --bridge-dir <dir> [permission-request]`).
- * Claude spawns it per hook event; it reads the hook payload on stdin and:
- *   - default (observer: SessionStart / Stop / StopFailure) → append it to the
- *     session's `hooks.jsonl` for the forwarder to tail.
- *   - `permission-request` → POST the payload to the daemon and RELAY the
- *     server's verdict JSON to stdout (the `{hookSpecificOutput:{decision:{…}}}`
- *     Claude reads to allow/deny). Blocks until the web user answers (Claude's
- *     hook `timeout` is a day). On any failure it writes nothing → Claude falls
- *     back to its own TUI permission prompt.
- *
- * Dependency-light (native-bridge + node builtins) so the per-event subprocess
- * stays cheap. Never exits non-zero — a crashing hook must not wedge Claude.
- */
-import { readPermissionHookConfig, recordHookEvent } from "./native-bridge.js";
+/** Standalone Claude hook adapter. Observer hooks append framing events; blocking
+ * interaction hooks rendezvous with the runner through the session bridge. */
+import { createHash, randomUUID } from "node:crypto";
+import { realpathSync } from "node:fs";
+import { claimInteractionResult, recordInteractionAck, recordHookEvent, recordInteractionRequest, removeClaimedInteractionResult, removeInteractionLease, touchInteractionLease, } from "./native-bridge.js";
+import { boundInteractionRequest, redactInteractionResolution, } from "../interactions.js";
 function argValue(argv, flag) {
     const i = argv.indexOf(flag);
     return i >= 0 && i + 1 < argv.length ? argv[i + 1] : undefined;
@@ -25,29 +15,278 @@ async function readStdin() {
         chunks.push(chunk);
     return Buffer.concat(chunks).toString("utf8");
 }
-async function relayPermission(bridgeDir, payload) {
-    const cfg = readPermissionHookConfig(bridgeDir);
-    if (!cfg)
-        return; // no server configured → empty stdout → claude's own TUI prompt
-    const url = `${cfg.serverUrl.replace(/\/+$/, "")}/api/sessions/${encodeURIComponent(cfg.sessionId)}/hooks/permission-request`;
-    try {
-        const resp = await fetch(url, {
-            method: "POST",
-            headers: { "content-type": "application/json" },
-            body: JSON.stringify(payload),
-        });
-        const text = await resp.text();
-        if (resp.ok && text) {
-            await new Promise((resolve) => process.stdout.write(text, () => resolve()));
+function asRecord(value) {
+    return value && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+function asString(value) {
+    return typeof value === "string" && value ? value : undefined;
+}
+function interactionId(payload) {
+    // PermissionRequest does not carry a tool_use_id. A per-process nonce keeps
+    // repeated or concurrent identical prompts from collapsing into one bridge id.
+    const invocationId = asString(payload.tool_use_id) ?? randomUUID();
+    const identity = JSON.stringify([
+        payload.session_id,
+        payload.transcript_path,
+        payload.hook_event_name,
+        invocationId,
+        payload.tool_name,
+        payload.tool_input,
+    ]);
+    return `claude_${createHash("sha256").update(identity).digest("hex").slice(0, 32)}`;
+}
+function questionRequest(id, toolInput) {
+    const questions = Array.isArray(toolInput.questions)
+        ? toolInput.questions.map(asRecord).filter((question) => Boolean(question))
+        : [];
+    const fields = questions.map((question, index) => {
+        const options = Array.isArray(question.options)
+            ? question.options.map(asRecord).filter((option) => Boolean(option))
+            : [];
+        const label = asString(question.question) ?? `Question ${index + 1}`;
+        const description = asString(question.header);
+        if (options.length > 0) {
+            return {
+                id: `q${index}`,
+                type: "select",
+                label,
+                ...(description ? { description } : {}),
+                required: true,
+                multiple: question.multiSelect === true,
+                allowOther: true,
+                options: options.map((option) => {
+                    const value = asString(option.label) ?? "";
+                    const optionDescription = asString(option.description);
+                    return {
+                        value,
+                        label: value,
+                        ...(optionDescription ? { description: optionDescription } : {}),
+                    };
+                }),
+            };
         }
+        return {
+            id: `q${index}`,
+            type: "text",
+            label,
+            ...(description ? { description } : {}),
+            required: true,
+        };
+    });
+    return {
+        interactionId: id,
+        kind: "question",
+        title: questions.length === 1
+            ? asString(questions[0]?.header) ?? "Input required"
+            : "Input required",
+        fields,
+        actions: [{ id: "submit", label: "Submit", style: "primary", requiresAnswers: true }],
+        context: { toolName: "AskUserQuestion" },
+        createdAt: Date.now(),
+    };
+}
+function permissionSuggestions(payload) {
+    const suggestions = Array.isArray(payload.permission_suggestions)
+        ? payload.permission_suggestions
+            .map(asRecord)
+            .filter((suggestion) => Boolean(suggestion))
+        : [];
+    const seenFilesystemTargets = new Set();
+    return suggestions.filter((suggestion) => {
+        const key = filesystemPermissionSuggestionKey(suggestion);
+        if (!key)
+            return true;
+        if (seenFilesystemTargets.has(key))
+            return false;
+        seenFilesystemTargets.add(key);
+        return true;
+    });
+}
+function filesystemPermissionSuggestionKey(suggestion) {
+    const rules = Array.isArray(suggestion.rules)
+        ? suggestion.rules.map(asRecord).filter((rule) => Boolean(rule))
+        : [];
+    if (rules.length !== 1)
+        return undefined;
+    const toolName = asString(rules[0]?.toolName);
+    if (toolName !== "Read" && toolName !== "Write" && toolName !== "Edit")
+        return undefined;
+    const ruleContent = asString(rules[0]?.ruleContent);
+    if (!ruleContent?.endsWith("/**"))
+        return undefined;
+    try {
+        const target = realpathSync(ruleContent.slice(0, -3));
+        return JSON.stringify([
+            asString(suggestion.type),
+            asString(suggestion.behavior),
+            asString(suggestion.destination),
+            asString(suggestion.mode),
+            toolName,
+            target,
+        ]);
     }
     catch {
-        // Server unreachable / hung → empty stdout → claude falls back to its TUI prompt.
+        return undefined;
+    }
+}
+function permissionSuggestionLabel(suggestion, index, total) {
+    const rules = Array.isArray(suggestion.rules)
+        ? suggestion.rules.map(asRecord).filter((rule) => Boolean(rule))
+        : [];
+    const firstRule = rules[0];
+    const toolName = asString(firstRule?.toolName);
+    const ruleContent = asString(firstRule?.ruleContent);
+    const directories = Array.isArray(suggestion.directories)
+        ? suggestion.directories.filter((value) => typeof value === "string" && value.length > 0)
+        : [];
+    const mode = asString(suggestion.mode);
+    let target;
+    if (toolName === "Read")
+        target = ruleContent ? `reading from ${ruleContent}` : "reading files";
+    else if (toolName === "Write")
+        target = ruleContent ? `writing to ${ruleContent}` : "writing files";
+    else if (toolName === "Edit")
+        target = ruleContent ? `editing ${ruleContent}` : "editing files";
+    else if (toolName === "Bash")
+        target = ruleContent ? `running ${ruleContent}` : "running Bash commands";
+    else if (toolName)
+        target = ruleContent ? `using ${toolName}(${ruleContent})` : `using ${toolName}`;
+    else if (directories.length > 0)
+        target = `accessing ${directories[0]}`;
+    else if (mode)
+        target = `using ${mode} permission mode`;
+    else
+        target = "this permission";
+    const extraCount = Math.max(0, rules.length - 1) + Math.max(0, directories.length - 1);
+    const suffix = extraCount > 0 ? ` and ${extraCount} more` : "";
+    const compactTarget = [...`${target}${suffix}`].length > 120
+        ? `${[...`${target}${suffix}`].slice(0, 119).join("")}…`
+        : `${target}${suffix}`;
+    const destination = asString(suggestion.destination);
+    const scope = destination === "session" ? " in this session" : "";
+    const label = `Allow, and don’t ask again for ${compactTarget}${scope}`;
+    return total > 1 ? `${label} (${index + 1})` : label;
+}
+function permissionSuggestionActionId(index) {
+    return `allow_suggestion_${index}`;
+}
+function permissionRequest(id, payload, toolInput, suggestions) {
+    const toolName = asString(payload.tool_name) ?? "tool";
+    const command = asString(toolInput.command) ?? asString(toolInput.file_path);
+    const cwd = asString(payload.cwd);
+    return {
+        interactionId: id,
+        kind: "permission",
+        title: `Allow ${toolName}?`,
+        fields: [],
+        actions: [
+            { id: "allow", label: "Allow once", style: "primary", requiresAnswers: false },
+            ...suggestions.map((suggestion, index) => ({
+                id: permissionSuggestionActionId(index),
+                label: permissionSuggestionLabel(suggestion, index, suggestions.length),
+                requiresAnswers: false,
+            })),
+            { id: "deny", label: "Deny", style: "danger", requiresAnswers: false },
+        ],
+        context: {
+            toolName,
+            ...(command ? { command } : {}),
+            ...(cwd ? { cwd } : {}),
+        },
+        createdAt: Date.now(),
+    };
+}
+async function waitForResult(bridgeDir, id) {
+    let lastLeaseAt = 0;
+    for (;;) {
+        const now = Date.now();
+        if (now - lastLeaseAt >= 1_000) {
+            touchInteractionLease(bridgeDir, id);
+            lastLeaseAt = now;
+        }
+        const result = claimInteractionResult(bridgeDir, id);
+        if (result)
+            return result;
+        await new Promise((resolve) => setTimeout(resolve, 100));
+    }
+}
+function answerText(value) {
+    return Array.isArray(value) ? value.join(", ") : value ?? "";
+}
+function nativeVerdict(hookKind, payload, result, suggestions) {
+    const toolInput = asRecord(payload.tool_input) ?? {};
+    const toolName = asString(payload.tool_name) ?? "tool";
+    if (result.status === "cancelled") {
+        const reason = result.reason ?? "Interaction cancelled";
+        return hookKind === "pre_tool_use"
+            ? {
+                hookSpecificOutput: {
+                    hookEventName: "PreToolUse",
+                    permissionDecision: "deny",
+                    permissionDecisionReason: reason,
+                },
+            }
+            : {
+                hookSpecificOutput: {
+                    hookEventName: "PermissionRequest",
+                    decision: { behavior: "deny", message: reason },
+                },
+            };
     }
+    const resolution = result.resolution;
+    if (toolName === "AskUserQuestion") {
+        const questions = Array.isArray(toolInput.questions)
+            ? toolInput.questions.map(asRecord).filter((question) => Boolean(question))
+            : [];
+        const answers = {};
+        questions.forEach((question, index) => {
+            const text = asString(question.question) ?? `Question ${index + 1}`;
+            answers[text] = answerText(resolution.answers?.[`q${index}`]);
+        });
+        const updatedInput = { ...toolInput, answers };
+        return hookKind === "pre_tool_use"
+            ? {
+                hookSpecificOutput: {
+                    hookEventName: "PreToolUse",
+                    permissionDecision: "allow",
+                    updatedInput,
+                },
+            }
+            : {
+                hookSpecificOutput: {
+                    hookEventName: "PermissionRequest",
+                    decision: { behavior: "allow", updatedInput },
+                },
+            };
+    }
+    const suggestionMatch = /^allow_suggestion_(\d+)$/.exec(resolution.actionId);
+    const suggestionIndex = suggestionMatch ? Number(suggestionMatch[1]) : -1;
+    const selectedSuggestion = Number.isSafeInteger(suggestionIndex)
+        ? suggestions[suggestionIndex]
+        : undefined;
+    return {
+        hookSpecificOutput: {
+            hookEventName: "PermissionRequest",
+            decision: {
+                behavior: resolution.actionId === "allow" || selectedSuggestion ? "allow" : "deny",
+                ...(selectedSuggestion ? { updatedPermissions: [selectedSuggestion] } : {}),
+            },
+        },
+    };
+}
+async function writeStdout(value) {
+    await new Promise((resolve) => process.stdout.write(JSON.stringify(value), () => resolve()));
 }
 async function main() {
     const argv = process.argv.slice(2);
-    const isPermission = argv[0] === "permission-request";
+    const mode = argv[0];
+    const hookKind = mode === "permission-request"
+        ? "permission"
+        : mode === "ask-user-question"
+            ? "pre_tool_use"
+            : undefined;
     const bridgeDir = argValue(argv, "--bridge-dir");
     if (!bridgeDir)
         return;
@@ -55,20 +294,70 @@ async function main() {
     let payload;
     try {
         const parsed = JSON.parse(raw || "{}");
-        payload = parsed && typeof parsed === "object" ? parsed : {};
+        payload = asRecord(parsed) ?? {};
     }
     catch {
-        return; // malformed hook payload — don't block claude
+        return;
     }
-    if (isPermission) {
-        await relayPermission(bridgeDir, payload);
+    if (!hookKind) {
+        try {
+            recordHookEvent(bridgeDir, payload);
+        }
+        catch {
+            // Observer hooks are best effort.
+        }
         return;
     }
+    const id = interactionId(payload);
+    const toolInput = asRecord(payload.tool_input) ?? {};
+    const suggestions = permissionSuggestions(payload);
+    const request = asString(payload.tool_name) === "AskUserQuestion"
+        ? questionRequest(id, toolInput)
+        : permissionRequest(id, payload, toolInput, suggestions);
     try {
-        recordHookEvent(bridgeDir, payload);
+        const bounded = boundInteractionRequest(request);
+        if (!bounded.ok) {
+            await writeStdout(nativeVerdict(hookKind, payload, {
+                status: "cancelled",
+                reason: bounded.reason,
+            }, suggestions));
+            return;
+        }
+        touchInteractionLease(bridgeDir, id);
+        try {
+            recordInteractionRequest(bridgeDir, {
+                interactionId: id,
+                hookKind,
+                waiterPid: process.pid,
+                request: bounded.request,
+            });
+            const result = await waitForResult(bridgeDir, id);
+            const verdict = nativeVerdict(hookKind, payload, result, suggestions);
+            // Claiming the response is the interaction commit point: it records what
+            // the user answered, while the later tool/Turn events record whether Claude
+            // could act on it. ACK before stdout is required because Claude may reap a
+            // command hook immediately after consuming its verdict.
+            recordInteractionAck(bridgeDir, result.status === "resolved"
+                ? {
+                    interactionId: id,
+                    status: "resolved",
+                    resolution: redactInteractionResolution(bounded.request, result.resolution),
+                }
+                : {
+                    interactionId: id,
+                    status: "cancelled",
+                    ...(result.reason ? { reason: result.reason } : {}),
+                });
+            removeClaimedInteractionResult(bridgeDir, id);
+            await writeStdout(verdict);
+        }
+        finally {
+            removeInteractionLease(bridgeDir, id);
+            removeClaimedInteractionResult(bridgeDir, id);
+        }
     }
     catch {
-        // Best-effort: a failed append must not fail the hook (would wedge claude).
+        // Empty stdout lets Claude fall back to its native UI instead of wedging.
     }
 }
 void main();

package/dist/claude/native-hooks.d.ts

@@ -16,8 +16,9 @@ export interface ClaudeHookSettings {
 export interface BuildClaudeHookSettingsOptions {
     /** The session's bridge dir (all hook subprocesses target it). */
     bridgeDir: string;
-    /** Register the blocking PermissionRequest hook (approvals → web). */
-    permission?: boolean;
+    /** Claude permission mode. bypassPermissions needs a PreToolUse question hook
+     * because PermissionRequest is intentionally skipped by Claude. */
+    permissionMode?: string;
     /** Register the MessageDisplay hook (live assistant-text streaming). */
     messageDisplay?: boolean;
     /** Register the statusLine command (context_window + cost capture). */

package/dist/claude/native-hooks.js

@@ -2,14 +2,14 @@
  * Build the Claude Code `--settings` JSON that registers rynx's claude-native
  * hooks. Each hook is a `command` that runs a standalone node entrypoint
  * ({@link ./native-hook-main.ts}) against the session's bridge dir; the
- * subprocess appends the hook payload to `hooks.jsonl` (observer) or POSTs to
- * the daemon and relays the verdict (PermissionRequest).
+ * subprocess appends observer events or blocks on the bridge's generic
+ * interaction result. It never calls or depends on the Control Plane.
  *
- * Registered here (the core turn-framing + approval subset; mirrors omnigent's
+ * Registered here (the core turn-framing + approval subset; mirrors reference implementation's
  * `build_hook_settings`):
  *   - `SessionStart`         → discovery (transcript_path + claude session id)
  *   - `Stop` / `StopFailure` → turn close (idle / failed)
- *   - `PermissionRequest`    → approvals (only when a serverUrl is provided)
+ *   - `PermissionRequest`    → questions and approvals
  *
  * Turn OPEN is transcript-driven (the `role:user` record), so `UserPromptSubmit`
  * is intentionally NOT registered. `MessageDisplay` (streaming) and `statusLine`
@@ -18,7 +18,7 @@
 import { fileURLToPath } from "node:url";
 /** Claude waits this long (seconds) for the PermissionRequest hook's verdict — a
  *  full day is effectively wait-forever for an interactive approval, matching
- *  omnigent (its default ~60s command-hook timeout would kill the long-poll). */
+ *  reference implementation (its default ~60s command-hook timeout would kill the long-poll). */
 const PERMISSION_HOOK_TIMEOUT_S = 86_400;
 /** Absolute path to the built standalone hook entrypoint (sibling `.js`). */
 export function resolveHookEntryPath() {
@@ -49,7 +49,16 @@ export function buildClaudeHookSettings(options) {
         Stop: [{ hooks: [observerHook] }],
         StopFailure: [{ hooks: [observerHook] }],
     };
-    if (options.permission) {
+    if (options.permissionMode === "bypassPermissions") {
+        const ask = shJoin([node, entry, "ask-user-question", "--bridge-dir", options.bridgeDir]);
+        hooks.PreToolUse = [
+            {
+                matcher: "AskUserQuestion",
+                hooks: [{ type: "command", command: ask, timeout: PERMISSION_HOOK_TIMEOUT_S }],
+            },
+        ];
+    }
+    else {
         const permission = shJoin([node, entry, "permission-request", "--bridge-dir", options.bridgeDir]);
         hooks.PermissionRequest = [
             { hooks: [{ type: "command", command: permission, timeout: PERMISSION_HOOK_TIMEOUT_S }] },